andrewbabu/loggly-mcp

Read-only **Model Context Protocol (MCP) server** for Loggly /apiv2/* APIs, plus IP
intelligence (RDAP, GreyNoise, AbuseIPDB). Exposes Loggly search/analytics/field tools,
aggregation-first traffic tools, and IP-context tools, while blocking write endpoints.
---
Skill Usage
For efficient log retrieval (less token use) and summarization, pair this server with a skill.
---
Quickstart
Install from npm
MCP client configuration:
Run from source
Edit .env with your Loggly credentials, then run:
Once the repo is trusted in Codex, the MCP server can also be started automatically via .codex/config.toml.
---
Configuration
The server loads .env from its working directory on startup.
Required
- LOGGLY_SUBDOMAIN
Loggly account subdomain or full Loggly URL (e.g. your-subdomain or https://your-subdomain.loggly.com)
- LOGGLY_TOKEN
Loggly API token
Optional
- LOGGLY_AUTH_MODE
bearer (default) or basic
- LOGGLY_MAX_RETRIES
Default: 2
- LOGGLY_REQUEST_TIMEOUT_MS
Default: 15000
- LOGGLY_LOG_LEVEL
error, warn, info (default), or debug
---
Remote (HTTP) Server
For a stdio server anyone on the team can reach from Claude Code without a local checkout, run
the HTTP variant instead and host it on an internal server/VM.
Edit .env with your Loggly credentials plus MCP_BEARER_TOKEN (generate one with
node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"), then:
This starts a stateless Streamable HTTP MCP server on MCP_HTTP_PORT (default 8787):
- GET /healthz — unauthenticated liveness check.
- POST /mcp — the MCP endpoint. Requires Authorization: Bearer ; every
other request to /mcp gets 401.
The Loggly credentials stay server-side — everyone connecting shares the same Loggly account
access. MCP_BEARER_TOKEN only gates access to the MCP server itself, so treat it as a secret
and rotate it if it leaks (e.g. re-generate and redistribute).
**Only run this behind your internal network/VPN**, not exposed directly to the public internet —
there's a single shared token, not per-user auth.
Connecting from Claude Code
Each org member adds the remote server once:
Swap in the internal hostname/port you deployed to and the token you were given.
Running with Docker
---
Multiple Accounts / Domains
The server can hold credentials for several Loggly accounts (different subdomains, different
tokens) at once and target them per tool call.
Set LOGGLY_ACCOUNTS to a JSON object mapping an account name to its credentials:
When LOGGLY_ACCOUNTS is set, it replaces LOGGLY_SUBDOMAIN/LOGGLY_TOKEN/LOGGLY_AUTH_MODE.
Every tool then accepts an optional account argument (e.g. account: "acme") to pick which
account's credentials to use for that call.
- If account is omitted, the server uses LOGGLY_DEFAULT_ACCOUNT if set, otherwise "default",
otherwise the single configured account if there's only one.
- An unknown account value returns an error listing the configured account names.
- iterate_events_next can also infer the account from the next_url host when account is
omitted, as long as exactly one configured account matches that host.
Existing single-account setups (just LOGGLY_SUBDOMAIN/LOGGLY_TOKEN) keep working unchanged —
they're treated as one account named "default".
---
Aggregation-First Traffic Tools
Raw event dumps are slow and expensive to reason about. These tools return a summary — totals,
top-N breakdowns, a bucketed timeline, and a small representative sample — instead:
- search_logs — the general-purpose version: query + time range in, aggregated summary out.
- traffic_by_ip / traffic_by_host / traffic_by_path — same aggregation, pre-scoped to one
IP/hostname/path.
- group_by_ip / group_by_path / group_by_user_agent — facet counts only (thin wrappers